Five U.S. federal agencies issued a joint alert on November 5 warning of an ongoing cyber threat targeting industrial refrigeration systems, including those used in grocery stores, healthcare facilities, and food storage. The warning follows recent incidents in Europe and suspected attacks on U.S. military bases.
Federal agencies identify active hacking campaign against refrigeration controllers
The Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Departments of Health and Human Services, Agriculture, and Transportation stated that hackers are exploiting vulnerabilities in internet-accessible temperature and commercial refrigeration controllers. These systems are widely used in healthcare, food and agriculture, chemical, and transportation operations.
Officials emphasized that successful attacks could allow hackers to alter temperatures, force units into continuous heating or defrost cycles, and create risks including inventory loss, equipment damage, and potential fire hazards. The agencies did not specify whether any U.S. systems had been compromised but noted that similar incidents have occurred in Europe in recent weeks.
Agencies urge immediate security measures for vulnerable systems
The joint alert recommended that organizations take immediate steps to secure their refrigeration systems, including:
- Removing control systems from the public internet
- Changing default and weak passwords
- Applying available software patches
- Replacing unsupported legacy devices
- Limiting or securing any necessary remote access
Chris Butera, CISA’s acting executive assistant director for cybersecurity, stated, “Every organization that depends on refrigeration and monitoring systems should assume it could be a target.” Brett Leatherman, FBI Cyber Branch Operations Director, added that the agency is observing these systems being targeted across critical infrastructure sectors globally.
Incidents prompt heightened scrutiny of industrial control systems
The warning follows reports of refrigeration outages at U.S. military bases in August, which the Pentagon is treating as a suspected cyberattack. Similar incidents have been reported in Europe, where hackers have remotely altered freezer temperatures in grocery stores and cold storage facilities.
While the agencies did not attribute the attacks to a specific group, the joint alert underscores growing concerns about the vulnerability of industrial control systems to cyber threats. The warning comes as governments worldwide increase efforts to secure critical infrastructure against digital attacks.